Data processing agreement (DPA)

DATA PROCESSING ADDENDUM

This Data Processing Addendum (“DPA”) supplements the Master Services Agreement (the “Agreement”) entered into by and between (i) the customer entity that is a party to the Agreement (“Customer”) and (ii) Aerospike, Inc. (collectively, “Aerospike” or “Company”) (thereinafter, the “Parties”). This DPA incorporates the terms of the Agreement, and any terms not defined in this DPA shall have the meaning set forth in the Agreement. Aerospike may modify the terms of this DPA from time to time. If there is any inconsistency between the terms of this DPA and the Agreement or any other agreement between the Parties relating to the subject matter of this DPA, the terms of this DPA shall prevail. 

1. DEFINITIONS

   1. Adequacy Decision means a European Commission decision determining that a transfer of Personal Data to a specific third country, territory or one or more specified sectors within that third country is secured by an adequate data protection regime in place. As of the effective date of this DPA, the following countries have received an Adequacy Decision from the European Union: Andorra, Argentina, Canada (commercial organizations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, Uruguay, the United States (commercial organizations participating in the EU-US Data Privacy Framework) and the United Kingdom (UK).

   2. “Company Account Data” means Personal Data that relates to Company’s relationship with Customer, including the names or contact information of individuals authorized by Customer to access Customer’s account and billing information of individuals that Customer has provided and associated with its account. Company Account Data also includes any data Company may need to collect for the purpose of managing its relationship with Customer, providing maintenance and support, identity verification, or as otherwise required by applicable laws and regulations.

   3. “Company Usage Data” means service usage data collected and Processed by Company in connection with the provision of the Services, including without limitation data used to identify the source and destination of a communication, activity logs, and data used to optimize and maintain performance of the Services, and to investigate and prevent system abuse.

   4. “Customer Data” means any Personal Data processed by Company on behalf of Customer in the course of providing Services or otherwise performing its obligations under the Agreement.

   5. “Data Privacy Legislation” means data protection or privacy laws, regulations, or regulatory requirements, guidance and codes of practice to the extent applicable to the Processing of Personal Data in connection with this DPA, including, without limitation, the California Consumer Privacy Act and the European General Data Protection Regulation and / or UK General Data Protection Regulation as well as the UK Data Protection Act 2018 (together referred to as “GDPR”), each as amended and supplemented, as the case may be, by the relevant EU Member States laws and regulations in which Customer directly or indirectly operates.

   6. “Data Subject Request” means a request from a Data Subject, Consumer, or authorized third party to exercise rights under applicable Data Privacy Legislation.

   7. “Deidentified Data” means data that cannot reasonably be linked to an identified individual or identifiable individual.

   8. “Personal Data Breach” means the actual unauthorized destruction, loss, alteration, disclosure of, use of, or access to Customer Data transmitted, stored, or otherwise Processed, or any other security incident involving Customer Data.

   9. “Services” means the contracted services that form the basis of the Agreement.

   10. “Personal Data” means (a) any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to a particular consumer or household, (b) any information related to an identified or identifiable natural person; or (c) any information that is defined as “personal data” or “personal information” by applicable Data Privacy Legislation. 

   11. “Supervisory Authority” means (i) an independent public authority which is established by a Member State pursuant to Article 51 GDPR (e.g., the Data Protection Commission in Ireland) or (ii) the Information Commissioner’s Office (ICO) in the UK.

   12. Others Terms. The terms “Business,” “Consumer,” “Controller,” “Data Subject,” “Joint Controller,” “Process” (and its cognates), “Processor,” “Sell” (and its cognates), “Service Provider,” and “Share” (and its cognates) have the meanings given to them under relevant Data Privacy Legislation.

2. ROLES OF THE PARTIES; PROCESSING OF DATA

   1. In relation to the Processing of Customer Data, the Parties acknowledge that Customer shall be acting as a Controller or Business (as appropriate), responsible for determining the purposes for which and the manner in which Customer Data is to be Processed, and Company shall be a Processor or Service Provider (as appropriate) under this DPA.  

   2. A description of the Processing, including the categories of Customer Data and the purpose for which Customer Data is Processed, can be found in Schedule I to this DPA.

   3. Each Party must comply with all applicable requirements of Data Privacy Legislation when Processing Customer Data under the Agreement, including providing the same level of privacy protection as required of Customer, as applicable, by the Data Privacy Legislation. 

   4. Company shall not knowingly do anything or knowingly permit anything to be done that might lead to a breach by Customer of the Data Privacy Legislation.

   5. Customer shall not provide or make available to Company any Personal Data in violation of the Agreement or otherwise inappropriate for the nature of the Services, and shall indemnify Company from all claims and losses in connection therewith. Customer shall, in its use of the Services, at all times process Personal Data, and provide instructions for the Processing of Personal Data, in compliance with Data Privacy Legislation. 

   6. Company shall:

      1. Only Process the Customer Data in accordance with Customer’s documented instructions and directions, including as set forth in this DPA and the Agreement, unless Company is required to Process Customer Data for other purposes under applicable law to which the Company is subject. Where such a requirement is placed on Company, it shall inform Customer unless prohibited by applicable law;

      2. Inform Customer if, in Company’s opinion, instructions given by Customer infringe Data Privacy Legislation prior to implementing such instructions;

      3. Notify Customer after Company makes a determination that it can no longer meet its obligations under this DPA or Data Privacy Legislation; 

      4. Process, use, disclose, or retain Customer Data only for the term of the Agreement or as otherwise specified in Schedule I to this DPA, whichever is earlier, and only for the limited and specified business purposes included in Schedule I to this DPA (the “Business Purposes”);

      5. Not: (a) Sell or Share the Customer Data with any third parties; (b) retain, use, or disclose the Customer Data for any commercial purpose other than the Business Purpose, unless expressly permitted by Data Privacy Legislation; (c) retain, use or disclose the Customer Data outside of Company’s direct business relationship with Customer, including by combining or updating the Customer Data with information Company received from another source or that Company collected from its own interactions with Data Subjects or Consumers, unless expressly permitted by Data Privacy Legislation;

      6. Ensure that all persons who have access to Customer Data are subject to a duty of confidentiality. Customer agrees that Company may disclose Personal Data to its advisers, auditors or other third parties as reasonably required in connection with the performance of its obligations under this DPA, the Agreement, or as required by applicable law;

      7. If Customer receives a request from a Data Subject attempting to exercise his or her rights under Data Privacy Legislation; any legally binding request for disclosure of; and/or request for access to Customer Data by a law enforcement authority unless otherwise prohibited under applicable law, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; or any legally binding request, order or inspection activity by a Supervisory Authority or other competent authority relating to Customer Data or privacy protection, promptly notify Customer. Customer is responsible for responding to Data Subject requests;

      8. Cooperate and provide reasonable assistance to Customer to respond to (i) Data Subject Requests under Data Privacy Legislation; and (ii) any inquiry made, investigation, or assessment of Processing initiated by any governmental authority;

      9. Use reasonable endeavors to assist Customer in its own compliance with Data Privacy Legislation, in connection with this DPA, including assisting Customer with data protection impact assessments, where required under Data Privacy Legislation, and as follows where required by Data Privacy Legislation:

         1. Customer shall use reasonable efforts to assist Customer with its obligations to consult the competent Supervisory Authorities prior to Processing where a data protection impact assessment indicates that the Processing would result in a high risk in the absence of measures taken by Company to mitigate the risk. Customer shall be responsible  for any costs and expenses arising from any such assistance by Company. 

      10. Allow Customer to, upon notice, take reasonable and appropriate steps to stop and remediate Company’s unauthorized use of Customer Data;

      11. Upon termination of its provision of Services, delete in a secure manner or return all Customer Data to Customer and delete any existing copies of the Customer Data, unless retention is required by applicable law or permitted by applicable law. If return or destruction is impossible or prohibited by law, rule or regulation, Company shall take measures to block such Personal Data from any further Processing (except to the extent necessary for its continued hosting or processing required by law, rule or regulation) and shall continue to appropriately protect the Personal Data remaining in its possession, custody, or control; and

      12. Take reasonable measures to ensure that any Deidentified Data Company receives from Customer cannot be associated with a Data Subject or Consumer, publicly commit to maintain and use the Deidentified Data only in deidentified form and not attempt to reidentify the data, not attempt to reidentify any Deidentified Data, except for the purpose of determining whether the deidentification process satisfies applicable Data Privacy Legislation, and contractually obligates recipients of the Deidentified Data to meet these same requirements.

3. INFORMATION AND AUDITS

   1. Upon Customer’s reasonable request at reasonable intervals, and subject to reasonable confidentiality controls, Company shall either:

      1. Make available to Customer information necessary to demonstrate compliance with this DPA, including copies of certifications or reports demonstrating such compliance; or  

      2. Where permitted by applicable Data Privacy Legislation and where the provisions of reports or certifications is not sufficient under applicable Data Privacy Legislation, Company may arrange for a qualified and independent assessor to conduct an assessment of Company’s policies and physical, technical and organizational measures using an appropriate and accepted control standard or framework and assessment procedure for such assessments. Company shall provide a report of such assessment to Customer upon reasonable request. Such assessment shall only be performed during business hours and occur no more than once per calendar year; and such audit shall be restricted to Customer Data. Customer shall be responsible for the costs of any such audits or inspections, including without limitation a reimbursement to Company for any time expended for on-site audits. 

   2. Should the assessment show a breach of this DPA or Data Privacy Legislation, including, but not limited to, security or confidentiality requirements, Customer may require Company to immediately remedy this breach. 

   3. Where required by Data Privacy Legislation, the Parties shall make the information referred to in this Section 5, including the results of any assessments, available to the competent Supervisory Authority upon request of the Supervisory Authority.

   4. Where required by Data Privacy Legislation, Company agrees to cooperate in good faith with the Supervisory Authority.

4. USE OF SUB-PROCESSORS 

   1. Customer consents to the engagement of the authorized sub-Processors listed in Schedule I.

   2. Customer shall not engage any sub-Processors to Process Customer Data without a prior notice to and opportunity to object for Customer. If Customer reasonably objects, Customer must do so within ten (10) days of being informed of such new sub-Processor and the Parties shall work together in good faith to agree on a reasonable solution, which may include termination of this DPA without penalty. If Customer does not object to the engagement of a new sub-Processor  in accordance with Section 4.2 within ten (10) days of notice by Company, that third party will be deemed an authorized Sub-Processor for the purposes of this DPA.

   3. Subject to the consent requirements above, Company may not engage any sub-Processor to Process Customer Data unless: (a) the sub-Processor is subject to a written agreement which imposes on the sub-Processor obligations that are compliant with Data Privacy Legislation and are no less protective than the terms set out in this DPA. At Customer’s reasonable request, Company shall provide a copy of the sub-Processor agreement and any subsequent amendments to Customer. To the extent necessary to protect business secret or other confidential information, including Personal Data, Company may redact the text of the agreement prior to sharing the copy.

   4. Where required by Data Privacy Legislation, Company shall include a third party beneficiary clause with the sub-Processor whereby — in the event Company has factually disappeared, ceased to exist in law or has become insolvent — Customer shall have the right to terminate the sub-Processor contract and to instruct the sub-processor to erase or return the Customer Data.

   5. For the avoidance of doubt, if Company engages a sub-Processor, Company remains liable to Customer for the performance of the sub-Processor’s obligations under Data Privacy Legislation. Company shall notify Customer of any material failure by the sub-Processor to fulfill its contractual obligations.

5. SECURITY

   1. Company shall implement appropriate technical, physical, and organizational measures, to protect Customer Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access in accordance with Data Privacy Legislation. In assessing the appropriate level of security, the Parties shall take into account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks involved for the Data Subjects. 

   2. The technical, physical, and organizational measures are documented in Schedule IV.

   3. Company shall, without undue delay following its becoming aware of a Personal Data Breach, notify Customer of such Personal Data Breach and take such steps as Company in its sole discretion deems necessary and reasonable to remediate such violation (to the extent that remediation is within Company’s reasonable control). As part of that notification, Company shall provide Customer with reasonable cooperation and assistance necessary for Customer to comply with its notification obligations under applicable Data Privacy Legislation.

   4. The obligations described in Sections 5.3 shall not apply in the event that a Personal Data Breach results from the actions or omissions of Customer. Company’s obligation to report or respond to a Personal Data Breach under Sections 5.3 will not be construed as an acknowledgement by Company of any fault or liability with respect to the Personal Data Breach.

6. COMPANY’S ROLE AS A CONTROLLER

   1. The Parties acknowledge and agree that with respect to Company Account Data and Company Usage Data, Company is an independent Controller, not a Joint Controller with Customer. Company will process Company Account Data and Company Usage Data as a Controller (i) to manage the relationship with Customer; (ii) to carry out Company’s core business operations, such as accounting, audits, tax preparation and filing and compliance purposes; (iii) to monitor, investigate, prevent and detect fraud, security incidents and other misuse of the Services, and to prevent harm to Customer; (iv) for identity verification purposes; (v) to comply with legal or regulatory obligations applicable to the processing and retention of Personal Data to which Company is subject; and (vi) as otherwise permitted under Data Privacy Legislation and in accordance with this DPA and the Agreement. Company may also Process Company Usage Data as a Controller to provide, optimize, and maintain the Services, to the extent permitted by Data Protection Laws. Any Processing by the Company as a Controller shall be in accordance with the Company’s privacy policy set forth at aerospike.com/forms/privacy-policy.

7. INTERNATIONAL DATA TRANSFERS

   1. The Parties agree that, to the extent any Customer Data is subject to the GDPR:

      1. Any transfer of Customer Data from Customer to a country outside the European Economic Area and/or the UK without an Adequacy Decision shall be subject to the terms of Schedules II and/or III, as appropriate. For purposes of such Schedule II and/or III, Customer is the data exporter and Company is the data importer. If any of the provisions of Schedule II and/or III are inconsistent with or in conflict with any of the provisions of this DPA then, to the extent of any such inconsistency or conflict, the provisions of Schedule II and/or III shall prevail.

      2. Company shall not transfer Customer Data outside the European Economic Area and/or the UK without: (i) obtaining Customer’s prior written consent and (ii) taking such measures as Customer may reasonably request to ensure that such transfer complies with Data Privacy Legislation, which includes, at Customer’s request, entering into (or procuring that such other persons as Company may reasonably specify enter into) appropriate contractual safeguards to protect such further sharing or transfer.

8. CERTIFICATION AND VIOLATION RIGHTS

   1. In the event that Company is in breach of its obligations under this DPA, Customer may instruct Company to suspend the Processing of Customer Data until the latter complies with this DPA or the Agreement is terminated. 

   2. Customer shall be entitled to terminate the Agreement insofar as it concerns Processing of Customer Data in accordance with this DPA if:

      1. The Processing of Customer Data by Company has been suspended by Customer pursuant to Section 8.1 and if compliance with this DPA is not restored within a reasonable time and in any event within one month following suspension;

      2. Company is in substantial or persistent breach of this DPA or its obligations under Data Privacy Legislation; or

      3. Company fails to comply with a binding decision of a competent court or the competent Supervisory Authorities regarding its obligations pursuant to this DPA or Data Privacy Legislation.

   3. Where required by Data Privacy Legislation, Company shall be entitled to terminate the Agreement insofar as it concerns Processing of Customer Data under this DPA where, after having informed Customer that its instructions infringe applicable legal requirements, Customer insists on compliance with the instructions.

9. SEVERANCE

   1. Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, while preserving the Parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.

10. GOVERNING LAW AND JURISDICTION

    1. The Parties submit to the choice of jurisdiction and governing law stipulated in the Agreement with respect to any disputes or claims arising under this DPA, including disputes regarding its existence, validity, termination or the consequences of its nullity.

Schedule I: Description of Processing

Schedule II: EU SCCs

This Schedule II applies to the Processing of Personal Data, where Customer is subject to the GDPR (excluding the UK General Data Protection Regulation).

1. Incorporation of SCCs. Module 2 of the Standard Contractual Clauses for the transfer of Personal Data (“SCCs”, available as of the Effective Date of this DPA at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj) are hereby incorporated by reference into this DPA and shall apply to the transfer of Personal Data as described in this Schedule II to the extent required by the GDPR. 

2. Existence of adequacy decision. To avoid doubt, the SCCs shall not apply to the extent that the international transfer is permitted as a result of an Adequacy Decision.  

3. Modifications to modules. The following elections are made in relation to the SCCs:

   1. Clause 7 (docking clause) — not selected.

   2. Clause 9 (use of sub-processors) — Option 2 is selected and the time period shall be 30 days.

   3. Clause 11 (redress) — optional wording is not included.

   4. Clause 17 (governing law) — Option 2 is selected and the applicable governing law shall be the laws of the EU Member State where the data exporter is located.

   5. Clause 18 (choice of forum and jurisdiction) — The applicable governing law shall be the laws of the EU Member State where the data exporter is located.

4. Details of data processing. The details required by the annexes to the SCCs shall be as follows:

Details of data importer and exporter

The relevant data importer or exporter’s signature of this DPA shall be deemed to include its signature to the SCCs. 

Description of transfer

Schedule III: UK ADDENDUM

1. Incorporation of UK SCCs. If an international transfer of Personal Data is subject to UK General Data Protection Regulation, then to the extent required by the UK General Data Protection Regulation:

   1. the SCCs shall be incorporated by reference into this DPA, with the modifications and details described in section 3 of Schedule II; 

   2. those SCCs shall be supplemented and amended by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued under section 119A(1) of the UK Data Protection Act 2018 (“UK SCCs”), available at the date of this DPA at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf; and

   3. the information requested in Tables 1 to 3 of the UK SCCs shall be deemed completed with the information set out in section 1.4 of Schedule II of this DPA. The information requested in Table 4 of the UK SCCs shall be deemed completed as follows: either the data importer or data exporter may end the UK SCCs.

2. Existence of adequacy decision. To avoid doubt, the UK SCCs shall not apply to the extent that the international transfer is permitted as a result of an adequacy regulation issued under the UK Data Protection Act 2018.     

Schedule IV: Technical and organizational measures to ensure the security of the data

Description of the technical and organizational security measures implemented by the Processor(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, as well as the risks for the rights and freedoms of natural persons.